19.2. Configuring Google workload identity federation

Procedure

1. Follow the instructions in the Google Cloud documentation to Use workload identity federation for GKE.

2. Annotate the RHACS service account by running the following command:

   $ oc annotate serviceaccount \
       central \
       --namespace stackrox \
       iam.gke.io/gcp-service-account=<GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com

   重要

   When setting up delegated scanning, use sensor instead of central.

Procedure

1. Follow the instructions at Manage workload identity pools to create a workload identity pool. For example:

   $ gcloud iam workload-identity-pools create rhacs-pool \
       --location="global" \
       --display-name="RHACS workload pool"

2. Follow the instructions at Manage workload identity pool providers to create a workload identity pool provider. For example:

   $ gcloud iam workload-identity-pools providers create-oidc rhacs-provider \
       --location="global" \
       --workload-identity-pool="rhacs-pool" \
       --display-name="RHACS provider" \
       --attribute-mapping="google.subject=assertion.sub" \
       --issuer-uri="https://<oidc_configuration_url>" \
       --allowed-audiences=openshift

3. Connect a Google service account to the workload identity pool. For example:

   $ gcloud iam service-accounts add-iam-policy-binding <GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com \
       --role roles/iam.workloadIdentityUser \
       --member="principal://iam.googleapis.com/projects/<GSA_PROJECT_NUMBER>/locations/global/workloadIdentityPools/rhacs-provider/subject/system:serviceaccount:stackrox:central"

   where:

   <system:serviceaccount:stackrox:central>

   Specifies the subject. For delegated scanning, you must set the subject to system:serviceaccount:stackrox:sensor.

4. Create a service account JSON containing the Security token service (STS) configuration. For example:

   {
     "type": "external_account",
     "audience": "//iam.googleapis.com/projects/<GSA_PROJECT_ID>/locations/global/workloadIdentityPools/rhacs-pool/providers/rhacs-provider",
     "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
     "token_url": "https://sts.googleapis.com/v1/token",
     "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<GSA_NAME>@<GSA_PROJECT>.iam.gserviceaccount.com:generateAccessToken",
     "credential_source": {
       "file": "/var/run/secrets/openshift/serviceaccount/token",
       "format": {
         "type": "text"
       }
     }
   }

5. Use the service account JSON as a secret to the RHACS namespace:

   apiVersion: v1
   kind: Secret
   metadata:
     name: gcp-cloud-credentials
     namespace: stackrox
   data:
     credentials: <base64_encoded_json>